Omno uses two different tokens. They have different purposes, lifetimes and scopes — keep them separate.
| API access token | Cashier session token | |
|---|---|---|
| Purpose | Authenticate server-to-server API calls | Authorize opening one Cashier session |
| Issuer | Token endpoint (sso.omno.com) | Returned by POST /v3/public/cashier/session |
| Format | OAuth 2.0 bearer (JWT) | JWT |
| Lifetime | ~300 seconds (expires_in) | 15 minutes, from session creation |
| Where it lives | Your backend only | Created on your backend, passed to your frontend to open the Cashier |
| Scope | All /v3/public/... calls your credentials allow | Only its own Cashier session — it cannot open or act on any other |
- It is mandatory: open the Cashier with
open({ sessionId, token }). Opening without the token is rejected. - It is a JWT, but treat it as opaque — don't decode, validate or inspect it. Omno verifies it.
- It is bound to its session and expires with the session (15 minutes). It has no separate expiry.
- You may reuse it for the same session until the session expires — for a reload, a refresh, or switching between deposit and withdrawal.
A session (and its token) is valid for 15 minutes from creation. When it expires, the Cashier shows a session-expired screen; create a new session and call open() again.
- Create the session right before you open the Cashier — for example when the player clicks Deposit — not at page load. This avoids customers hitting expiry mid-flow.
- Create it server-side. Never create sessions from the browser.
- Never log or store the token. Pass it straight through from your backend to the frontend and into the SDK.
- On expiry, create a new session — there is no refresh for an expired session.